Recent content on Matt's Headroom
I’ve been largely hands-off with LLMs after testing the waters from time to time and not finding much utility in tech that can inherently lie to you. Anthropic’s Claude series of models became unexpectedly, incredibly capable sometime back in November or December (just as my second kid was born so no wonder I missed the news), especially compared to previous times I’d used it.…
I spotted Anthropic’s offer of six free months of Claude Max 20x for open-source maintainers today. It was thanks to having access to Claude Opus 4.6 this week at work that I was able to vibe code a POC passkey provider app for iOS into existence (a topic for another post perhaps.) I have to admit the experience shifted me from AI skeptic to AI-intrigued. It turns out Claude has come a long…
How I saved $60/yr on my family password management: I unironically think physical password books like these can be suitable solutions for people who aren’t yet ready to embrace software credential managers. Most people don’t have to factor “someone breaks into my house and steals my passwords” into their threat modeling, and a book like this encourages using unique…
With the game calling itself “Prince of Persia” I initially thought it would somehow tie in to The Sands of Time trilogy from way back on the GameCube; I couldn’t quite make sense of this when I also heard that The Lost Crown was a metroidvania. This uncertainty had me put off playing the game for everything else on my gaming backlog, despite all of the really positive news…
Astro Bot, just like Astro’s Playroom before it, wraps very responsive platform controls around an absolutely adorable visual aesthetic. But unlike Playroom, Astro Bot is a lot more game and turns the creativity up to 11. Every world is colorfully, uniquely themed, and there are a surprising number of callbacks to PlayStation IP (vis-a-vis bots you rescue on each level themed as different…
Talk about a visual aesthetic in search of gameplay. The clunky controls and awful automatic checkpoints had me drop this game just a couple hours in. It’s a shame because I love the H.R. Giger aesthetic. The unnerving combination of flesh and machinery makes for really provocative imagery, and has inspired countless unsettling, iconic character designs over the years. I’m only taking…
There was some recent discourse about passkeys that bemoaned that they have so many issues that it’s better to stick with a password manager. The idea is that maintaining strong, unique passwords via a password manager is easier for users to understand. This completely misses the key point about why passkeys are such a stronger way of protecting login, though, so I decided to spend some time…
## DescriptionAuthentication is a complicated problem with ever-creeping scope. Passkeys provide phishing-resistance at the point of authentication, but you need protection at enrollment and during the authenticated session thereafter, too, to truly fortify the authentication process against evolving threats. In this discussion, authentication experts Chris Anderson and Matthew Miller will walk…
## DescriptionHave you wondered about where to start with implementing FIDO for your web sites and services? Maybe you’ve done some research but phrases like “MDS”, “attestation”, and “challenge” make things confusing. Let us help you lift the fog of confusion as we go through the top 5 questions about implementing FIDO2. We’ve scientifically pulled these…
## DescriptionCome hear answers to five common “how do I…” questions that Relying Party developers ask when adopting FIDO2-based authentication. I’ll walk you through why people are asking these questions, and provide context for answers that might just surprise you. ## Links Slides: Authenticate 2024 - Answering common questions from RP devs.pdf
## DescriptionAuthentication is a complicated problem with ever-creeping scope. Passkeys provide phishing-resistance at the point of authentication, but you need protection at enrollment and during the authenticated session thereafter, too, to truly fortify the authentication process against evolving threats. In this discussion, authentication experts walk through all of the components of a user…
## Back to barbecuingIt’s been nearly 10 years since the last time I grilled anything at home thanks to pesky HOA rules at our last place. Now that I’m free from that tyranny, though, I’m determined to get my grilling groove back on. Last weekend it was thanks to the tireless efforts of my lovely wife that I managed to snag a Weber Spirit E-210 for free off of one of those…
Just a quick update, I’ve added all of the talks I’ve given at industry conferences since 2022. They’re all here under the new presentations category so I have a single place to share around when people ask: /categories/presentations/ Videos and slides are included when available. As of today I’ve got four presentations and one panel across Authenticate 2022, Authenticate…
## DescriptionThere have been a few blog posts (and resulting social media and forum discussions) going around the past few weeks about #passkeys, mostly painting them (or organizations who have been working hard to bring passkeys to users all over the world) in a negative light. Many of the responses have been accusatory, conspiratorial, or just plain incorrect. In this episode Tim and Matthew…
A week or so after writing about passkeys support on the Quest 3 I had spent enough time with the device to know that it just wasn’t meant to be. But while I ultimately packed it all up, brought it back to the store, and put it in my rear view mirror, I still liked some parts of the experience. Below are lingering thoughts about my time with the Quest 3 and how I think it compares to the…
I recently appeared on the Software Engineering Daily podcast to talk about my work on SimpleWebAuthn! Here’s the summary of everything we talked about: SimpleWebAuthn is an open source TypeScript-centric pair of libraries – frontend and backend – that make it easier for devs to implement WebAuthn on the web. Matthew Miller started the project in 2019 and it has grown in tandem with the…
I picked up a Meta Quest 3 thanks to Apple Vision Pro launch day hype, ostensibly to see what the latest and greatest in consumer VR looked like without dropping $3500 on a single gadget. I’ll note that I’ve been a long time owner of a VR setup: I purchased an HTC Vive shortly after its launch and eventually upgraded it to wireless and a pair of Valve’s Index controllers.…
I played the original Ori and the Blind Forest a couple of years ago and appreciated its metroidvania for having tight movement and combat controls, and not trying to be too clever. It was also a bit on the shorter side, a dozen hours or so, but in a good way. I was happy to see that its sequel is “more of the same”. Ori and the Will of the Wisps had gorgeous graphics, was very…
This game series flew completely under my radar all these years. It wasn’t until a recent trip abroad that my fellow Switch friends recommended me this game and boy, I’m glad I listened. The game surprised me the most with how everything was voice-acted. I did a double-take in the first few minutes when I realized that Spike Spencer (the gentleman who dubbed Shinji’s voice in…
When WebAuthn first hit the scene, Relying Parties (RP’s) could choose to launch navigator.credentials.create() with one of two values for authenticatorAttachment (introduced in WebAuthn L1): "cross-platform" would have browsers guide users through security key registration Browsers would focus on local platform authenticator registration with "platform" Things were simple, and predictable,…
## DescriptionHave you wondered what the relationship is between passkeys and WebAuthn? Join Nick Steele and Matthew Miller as they clear this up and more! ## Links Slides: Authenticate 2023 - Demystifying WebAuthn and Passkeys.pdf
## DescriptionWe started with passwordless, but why stop there? It’s time for another round of opinionated guidance on making passkeys more user-friendly. Then stay for advice on how best to integrate your existing WebAuthn authentication into your native apps. ## Links Slides: Authenticate 2023 - Tips for Painless Passkeys.pdf
## DescriptionIn this on-demand webinar we will discuss: An overview of the state of the passkeys and their progress toward replacing passwords The merits of WebAuthn (the foundation of passkeys), as an authentication method Passkey’s role in Duo’s Passwordless solution and migration considerations ## Links Webinar On-demand Replay: https://duo.com/resources/webinars/the-state-of-passkeys…
What the hell is this game? I mean just look at this chaos lmao I guess you could call it a rogue-like. Each map starts out with just a few enemies here and there, but as the minutes tick by there are ever-increasing numbers of enemies who swarm you while you bob and weave to avoid them. Weapon synergies make or break a run, but fortunately as you learn the synergies you unlock the ability to view…
SimpleWebAuthn debuted in May 2020 as three interconnected libraries that aimed to make WebAuthn simpler to use across browsers and “NodeJS + CommonJS” applications. Since then NodeJS has evolved to gain ECMAScript module (ESM) support, and additional JavaScript and TypeScript runtimes have debuted that offer ESM-centric, TypeScript-first alternatives while also implementing Web APIs…
Security keys are great! They’re considered the “gold standard” of FIDO2 authenticators because they strongly protect the private keys that power WebAuthn-based authentication. A credential registered via a security key is guaranteed never to appear from another security key. Compromising a security-key-protected account thus requires interception of the physical security key as…
There wasn’t a lot of news about passkeys at WWDC23. And in fact I had to go digging to find more than the single passkeys-specific “Deploy passkeys at work” video available on the Apple Developer app: Last week I managed to glean more insights into Apple’s continuing evolution of their passkeys support from other places online, though, so I decided to pull it all together.…
Apple’s Vision Pro hardware announcement at WWDC23 was of course quite the spectacle. After years of rumors Apple finally announced their newest hardware platform, a fully standalone pair of ski goggles that seems to offer a delightful AR/VR user experience to tech reporters who managed to snag some time with it. One thing that stood out to me, though, was the announcement of Optic ID. This…
## DescriptionCan you believe it’s been over a year since passkeys were announced?! And what an exciting year it has been as we continue making progress towards pushing passwords out of our lives for good! Join us for a panel discussion with subject matter experts from Microsoft, Google, Cisco, and the FIDO Alliance. We’ll look back at the first year of passkeys in the wild, from…
## DescriptionOver the past few years we’ve seen a meteoric rise in MFA adoption. It’s been driven in part by the pandemic and by development of easier authentication experiences for end users. With passkeys and conditional UI now here, logging in with FIDO2 is going to get faster and more accessible for users. How should developers get started? Join two FIDO WebAuthn experts to get…
I was asked to be a guest on the Mac Admins Podcast, and Episode 304 is now live! Here’s their summary of all the WebAuthn-related things we talked about: Apple’s version of passkeys are the latest piece of a sprawling identity picture for the Apple platform that isn’t widely supported just yet – which is a perfect time to start learning about it. Passkeys aren’t just Apple; they’re…
WebAuthn defines two possible values that Relying Parties can set to help users understand for which account they’re registering a credential and using in subsequent authentications: user.name (spec) user.displayName (spec) It was unclear to me from reading the spec how exactly I was supposed to use either value: user.name When inherited by PublicKeyCredentialUserEntity, it is a…
Edit (May 2025): Hello from 2025! This article continues to see a decent amount of traffic, especially as more people find out about PRF and want to learn more. However, I strongly encourage you to consider the following: 🚨🚨🚨 If you delete a passkey you will permanently lose access to all of its PRF-protected data! 🚨🚨🚨 In such a scenario there is no way to recover PRF-protected data.…
A year ago today, for no real reason I thought, “can I close all three rings on my Apple Watch for a whole year?” 365 days later, on November 22 2022, the answer is, “yes, I can!” 🥳 The rings represent the daily activity goals I’d set for myself: 550 active calories 35 minutes of exercise 12 hours of standing I’m honestly really surprised that I was able to…
Stray is a “cat adventure game” that I’d followed development of for over seven years! It very quickly won me over both for the setting (based off of Kowloon Walled City) and for the effort they put into animating the cat. It looked like it would be a very charming game: The game released in July 2022, but I waited to play because the reviews claimed it was only 6-8 hours long.
I think I remember this game being touted as a true demonstration of the next-gen capabilities of the PS5. Something about the transition between maps via the game’s “rifts” being seamless because the game could stream data at insanely high rates. Practically speaking, the well-executed traveling between dimensions made this game very hard to ever put down. I think that’s…
## DescriptionYou’ve decided to “go passwordless”, but your users are confused by it all: “Why is my browser asking me to choose between Security Key or This Device?” “Why does the site show an error when I try to log in with my phone?” “I registered in Chrome, but Safari won’t let me log in…help!” Though Relying Parties have almost no…
On October 12, 2022 Google announced the availability of a beta version of their upcoming passkeys implementation. This included instructions for opting-in to a beta version of Google Play Services, as well as announcing the availability of Chrome Canary 108 with better default support for Conditional UI (i.e. there’s no more need to start Chrome Canary with the…
It’s been a few months since my last posts about Apple’s passkeys implementation (here and here). Passkeys officially launched with iOS 16 on September 12th, and macOS Ventura betas have been stable enough that I’ve been able to capture some nuances of this functionality across Apple’s passkey “ecosystem”. ## iCloud Keychain sync is a requirementApple…
I originally started this game back just before Elden Ring came out. When I caved to Elden Ring internet peer pressure I dropped it entirely. I came back afterwards…but almost begrudgingly? It’s been an odd case of wanting to experience the story, but not feeling all that enthusiastic to engage with the gameplay in between. Don’t get me wrong, HFW is refined Horizon Zero Dawn, and…
I’d missed playing all the other God of War games growing up for lack of a PlayStation console. This time, though, I’d heard enough good things about the 2018 reboot of God of War, and the price was right, (free, for being an item in the PlayStation Plus Collection) so I decided to give it a shot. Boy, was I pleasantly surprised! The combat was just challenging enough, the map…
Testing passkey registration with “direct” attestation and tracking what happens. A reminder that the SimpleWebAuthn response debugger is available for those who wish to directly introspect the registration or authentication responses. ## macOS Ventura Beta 2 - Safari Version 16.0 (18614.1.16.11.3)### Registration// Registration Options { "challenge":…
At WWDC 2022 Apple released a session simply titled, “Meet passkeys”. In this video we finally got to see everything they’ve been working on since the passkey Technical Preview debuted after WWDC 2021. Boy, did Apple come out swinging with their support for the next generation of WebAuthn. I started documenting interesting bits out of the video on Twitter, but by the time I…
On May 5th, 2022 the FIDO Alliance coopted World Password Day (created by Intel Security in 2013, as it turns out) with its “Less Passwords Day”: Headlining this tongue-in-cheek reveal was the actually interesting announcement that Apple, Google, and Microsoft were all committing to support multi-device credentials and cross-device authentication within the next year! Somehow the FIDO…
Last year at WWDC 2021 Apple announced a tech preview of their upcoming “passkeys”. These were otherwise normal WebAuthn credentials, except their private key material would get synced between devices via iCloud Keychain! In one fell swoop Apple had seemingly offered up a solution to users getting locked out of their WebAuthn-protected accounts if they lost their phone. Nearly a year…
## NotesMy initial reaction to this game, from previews to launch, was “ah, another FromSoft game in the vein of Dark Souls? Pass.” The hype around this game was just too much, though, that I couldn’t ignore it anymore. After seeing it take over gaming Twitter, YouTube, and Twitch, and it blowing up my RSS feeds, reports of a vastly more accessible entry in the Soulsborne genre…
## DescriptionWith widespread platform support for FIDO, it’s now easier than ever for developers to integrate FIDO strong authentication into their websites or apps. But there are still plenty of questions developers often have before getting started. Join this Ask FIDO Anything webinar with developers that have first-hand knowledge of FIDO to get answers to all of your pressing questions!
I enjoyed the heck out of this game! The writing in particular was fantastic. Believable character development, Telltale-light consequences of my actions bearing fruit later, and a great sense of travel across the galaxy all came together to create a unique game that I encourage you to try. The level of detail in all of the maps was surprisingly high and made for gorgeous vistas. And in addition…
I brought my daughter grocery shopping with me tonight. She likes to inspect everything before “helpfully” dropping it into the cart, and so in the produce section I picked up a lemon and of course handed it to her. She grabbed the lemon and surprised me with a reaction reminiscent of a double take. I took a moment to review with her the lemon’s smooth-but-bumpy skin, to which…
I recently rearranged the blog’s posts file structure to take advantage of Hugo’s Page Bundles feature. Without going into too much detail this reorganization enabled me to bundle post content into self-contained folders. Within these folders is a single index.md file containing the post’s Markdown, as well as an images/ folder into which all of the post’s images reside: I…